.dockerignore: let moments.js into the image; guard test checks the allowlist too

f38f218 failed to build: .dockerignore is an allowlist and kept
moments.js out of the build context. Verified by building the image and
starting the reader from it (health ok).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.dockerignore

@@ -10,6 +10,7 @@
 !backup.js
 !reading-analytics.js
 !reading-access.js
+!moments.js
 !public/
 !public/**
 !greatest/